access_control_policies

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must disclose behavior, but it only gives a GraphQL query example. It doesn't mention pagination semantics (though 'after' and 'first' hint at it), return format, authentication requirements, or side effects. The example is a static variable set, not behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, leading with the operation name, then variables, then an example. The example is somewhat verbose but packed with useful details. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 6 parameters, no annotations, and no output schema, the description is incomplete. It doesn't state what the tool returns (e.g., a list of policies, pagination info), the meaning of 'customerId' vs 'customer_slug', or any defaults/constraints. The example is a starting point but insufficient for confident use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema descriptions are minimal (just type names), so the description adds value by listing all parameters and providing an example that shows nested structures for 'policyFilter' and 'policyOrder'. This helps infer expected formats beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states 'query accessControlPolicies', which clearly identifies the operation as a query for access control policies. It uses a specific verb and resource, and the plural form suggests listing, though it doesn't explicitly differentiate from the singular 'access_control_policy' sibling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided about when to use this tool versus alternatives like 'access_control_policy' (singular) or 'create_access_control_policy'. The description only lists variables and an example, without stating any conditions or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.